How we check files
This page describes what actually happens to an installation file before it reaches you, and how much of the catalog has been through it. The figures below are counted from the database when the page is opened, not typed into the text by hand.
State of the catalog
The file was found in the VirusTotal database and engines returned a verdict on it.
A lookup was made, but the file is not in the VirusTotal database — meaning no engine has ever seen it. That is not “clean”, and we say so.
Published listings whose served file the check has not reached yet. The listing says exactly that.
Measured: 2026-10-27 18:38 UTC. Refreshes automatically.
Pace
Files checked in the last week: 2. Still unchecked: 0 — that counts every file in storage, including older versions and unpublished listings; among published listings, 0 served files are unchecked (the “Still queued” row above).
No unchecked files are left.
What is actually done to a file
- On upload the file is parsed: SHA-256 is computed, the manifest is read, the signing certificate is extracted. All of it is printed in the listing.
- The file is looked up in VirusTotal by SHA-256. For XAPK and APKM the hash of the inner base.apk is used, not the container’s: a container has its own hash that VirusTotal has never seen.
- The answer comes in three kinds, and we do not merge them: engines saw the file and found nothing; engines found detections; the file is not in the VirusTotal database at all.
- A file with more detections than the threshold is not served, and the app is unpublished automatically, with no human in the loop.
- An unchecked file is not blocked: antivirus here is an extra signal, not an entry pass. The listing states plainly that no check has happened.
Why this does not take a single day
The project’s VirusTotal key is a free one: four requests per minute and five hundred per day. So the queue runs in the background in small batches with pauses, rather than being cleared in one sweep. Published listings go first — their files are the ones actually served to visitors.
The order inside the queue is random rather than top-of-the-list. A deterministic order against an exhausted quota would mean every next sweep picking the same files and the queue never moving — which is exactly what happened until it was fixed.
What this check does not prove
- A clean verdict is the absence of detections at the time of the lookup, not a safety guarantee. Engines may learn to recognise a new malicious build later.
- We do not perform manual behavioural analysis of apps, and we do not claim to.
- Single detections on APKs are routine: packers and ad SDKs get caught by heuristics. That is why the unpublish threshold is not one, and why the detection itself is shown in the listing.
- VirusTotal alone is not enough as the only argument. That is why the SHA-256 and the certificate fingerprint are printed alongside: the signature is the most reliable sign that a file was not swapped on the way.
What we know about you when you download
- No account is needed to download, and none can be created — the site has no sign-up.
- The download log stores a hash instead of your IP address. The hash is not irreversible, so we treat it as personal data and delete it on a schedule.
- The file link is temporary and signed: we have no permanent direct links into storage.
The current threshold: up to 3 detections keeps the app listed with a note, more than that unpublishes it automatically.
About the project →